Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

CaptureOptical v2.0 – "AutoCapture" from Drives

Updated: 29 Jul 2010 | 5 comments
toralf's picture
0 0 Votes
Login to vote

This is one solution to the Tool Bounty on AutoCapture. This software monitors any drive on your system for execution of installation files. The only exceptions are drives the OS and the programs are installed on. Even though the name of this software indicates that it is for optical drives, it is not limited to them. The naming is purely historical.

Note: AutoStarts are not captured (yet), since the process is not started on the drive, but from the OS.

When an installation process starts (any *.exe, *.msi, *.bat or *.cmd file) on these monitored drives its actions are captured into a new SVS layer automatically. All other files are executed normally. Also all actions on all other drives react normally.

Before capturing a new process all active layers get deactivated. And the new layer is flagged not to "Start Automatically". An icon on the desktop and in the program menu removes all layers captured with this software, all other layers survive.

The program consists of three executables. One is doing the actual work. The other two are for setup and start. Make sure that you do not kill the start file! Only stop it with the tray icon or shutdown the PC.

The user needs to have rights to stop the Start file and to read and write to these registry hives:

HKCR\exefile\shell\open\command
HKCR\Msi.Package\shell\Open\command
HKCR\batfile\shell\open\command
HKCR\cmdfile\shell\open\command

A link to the Start file can be placed anywhere to start it with logon. It starts to capture 7 seconds after it gets loaded. This gives other processes the chance to start without the capture.

!!! WARNING !!! This software is a prototype / proof of concept. No warranty for anything. I recommend testing it in a virtual machine or creating a backup of your system. Do not use it in production (yet).

Any feedback on bugs or improvements is highly appreciated.

License: AJSL
By downloading the attached file, you agree to the terms and conditions in the Altiris Juice Software License
Support: User-contributed tools on the Juice are not supported by Altiris Technical Support. If you have questions about a tool, please communicate directly with the author by visiting their profile page and clicking the 'contact' tab.

Comments

FrankB's picture
10
May
2007
0 Votes 0
Login to vote

My compliments!

When this is finished I would recommend you for the Bounty.
5 Points from me.

FrankB

______________________________________________
Frank Bastiaens
Senior Technical Consultant
Vanderlet B.V.

toralf's picture
10
May
2007
0 Votes 0
Login to vote

Thanks a lot. I was a bit

Thanks a lot. I was a bit scared when I started to mess with the registry, but it seems to work.

Ciao
toralf

FrankB's picture
11
May
2007
0 Votes 0
Login to vote

Might I give you a tip?

Use Virtual PC of Microsoft.
If something goes wrong you revert to a previous state, a lot safer :)
VPC is available for free.

Kind Regards, FrankB

______________________________________________
Frank Bastiaens
Senior Technical Consultant
Vanderlet B.V.

toralf's picture
11
May
2007
0 Votes 0
Login to vote

Tips are always welcome.

I appreciate the tip.

The funny thing is I wrote an article for the Juice on virtual machines just a month ago. Since then, I reinstalled my whole system and didn't want to install VMs, so I try to live without them.

Ciao
toralf

erikw's picture
13
May
2007
0 Votes 0
Login to vote

Stop using VMs

Toralf, i truly believe in VMs, it is a great way playing around with software and even develop. It is very important doing this on clean machines and do not get messed up with apache, sql and various other junk in packages, and so on.

Regards
Erik
www.svs4u.nl

Regards Erik www.DinamiQs.com Dinamiqs is the home of VirtualStorm (www.virtualstorm.org)

*************************************************************
If your issue has been solved, Please mark it as solved
***********